hhhhhhwwwwwwowwwwwwww

How many recommendations would a vCISO recommend if a vCISO could recommend recommendations?

This kind of makes her post funnier, though: "GO WIN A FUCKING MEDAL, DEREK!"

I help organizations align cybersecurity with mission-critical goals through trusted vCISO services. #vCISO #CyberSecurity www.natsar.com/vciso-services

> vCISO

i hate that i think this would work

Meu primeiro dia como DevSecOps oficial, ficando a frente da segurança da empresa e com reunião de alinhamento com a empresa de consultoria vCISO...
...
...
...
...
e eu tô tossindo meu pulmão fora.

Someone submitted an anonymous AMA question on my blog to get my thoughts on how they might package up their services for a new vCISO practice for their smaller SMB customers (25-100 employees), and how they might account for onboarding vs ongoing operational work. Here are my thoughts. 👇

The retainer may include a limited number of vCISO consulting hours per month, but the rate for an executive level vCISO consultant is high enough that the model can break without that limit.

The pattern that I suggest has three components. A security assessment up front, the retainer to build and operate the program, and hourly vCISO Advisory consulting sprinkled on top sparingly to provide executive level support.

The challenge with a vCISO consulting practice within an MSP, especially one that targets smaller SMBs, is that the pure advisory consulting workload can be very inconsistent, and SMB clients struggle to see the value in a retainer for advisory services only. Execution produces value for them.

And we are live at the Fourth annual #CISOEnsemble with the fantastic panel moderator @nikkic360.bsky.social on the CISO vCISO debate! mssnetwork.com/ciso

Depends on how many recommendations a vCISO can pick in a pack of pickled recommendations.

vCISO vs. a full-time CISO hire for your startup? It depends on stage — and it is costly to get wrong. A framework covering cost, coverage, and maturity (plus where the vCISO model has real limits): https://www.sheersafe.com/insights/virtual-ciso-vs-full-time-hire-startups

Onboarding a new client into your vCISO practice, assessing their current state, and building their program to get them to a steady state for ongoing operations is time consuming.

The results of that assessment drive the proposal for the rest of the work, both the retainer for security operations, and the hourly vCISO consulting. It provides the necessary context to frame value to the client and allows the contract to be right sized to keep it as affordable as possible.

If this whole vCISO Advisory consulting thing doesn’t work out, maybe people will pay me to install systems in their digital nomad rigs.